@clear-capabilities/agentic-security-scanner 0.195.1 → 0.195.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md
CHANGED
|
@@ -9,6 +9,24 @@
|
|
|
9
9
|
> make the history less accurate, not more.
|
|
10
10
|
|
|
11
11
|
|
|
12
|
+
## 0.195.3 - The VS Code extension's build tool no longer pulls in a vulnerable minimatch
|
|
13
|
+
|
|
14
|
+
Why: the 0.195.2 release workflow stopped at its dependency check. A new advisory (GHSA-g3hv-75wg-m249, moderate, denial of service in minimatch before 11.0.1) reached `ide/vscode` through `@vscode/vsce`, which asks for `minimatch ^10.2.6`. The check passed on the same tree 16 minutes earlier, so the advisory was published during the release. Nothing was published to npm for 0.195.2; its tag exists and points at a commit that failed the gate, so the fix ships as 0.195.3.
|
|
15
|
+
|
|
16
|
+
- **`ide/vscode` overrides `minimatch` to `^11.0.1`** (the only fixed line). `npm audit` reports 0 vulnerabilities; the extension still builds and type-checks. The override can be dropped when `@vscode/vsce` raises its own range.
|
|
17
|
+
- **Carries everything in 0.195.2:** trend jobs off pull requests, the cabal-store-only cache fix.
|
|
18
|
+
- **Measured for the 0.195.2 attempt (not a release):** push 313 s, hosted checks 702 s (cold cabal cache under the new key, plus one timing check re-run), release workflow 162 s to the failed gate.
|
|
19
|
+
|
|
20
|
+
## 0.195.2 - Trend jobs no longer take runner slots from the blocking jobs on a pull request
|
|
21
|
+
|
|
22
|
+
Why: the release requirement is under 10 minutes. On the 0.195.1 pull request the `ci` workflow started about 33 jobs at once and blocking jobs waited up to 200 s for a runner, while five informational jobs that nothing waits on held slots for 20 to 44 minutes (`local-model`, `realworld-bench`, `synthetic-bench`, `jetbrains-plugin`, `chrome-exports`). They only delayed the jobs that decide whether the change can merge.
|
|
23
|
+
|
|
24
|
+
- **`local-model`, `jetbrains-plugin` and `chrome-exports` run on pushes to `main`, not on pull requests** (`if: github.event_name != 'pull_request'`). A skipped job counts as passing in the hosted-CI check, and each still reports on every merge.
|
|
25
|
+
- **`bench.yml` (synthetic, real-world and SARD smoke trends) runs on its daily schedule and on demand, not on pull requests.** This reverses the pull request trigger its header had kept on purpose; the header now says why. The blocking correctness gates (`corpus`, `bench-gates`, `bench-gates-b`, mutation) still run on every pull request.
|
|
26
|
+
- **`language-tools-ghc` caches the cabal store only, under a new key.** 0.195.1 also cached `~/.ghc`; once that cache became readable, `cabal install --lib` refused to overwrite the packages the restored environment already listed and the job failed on the 0.195.2 pull request. The environment file is rebuilt from the store in seconds.
|
|
27
|
+
- **Unchanged on purpose:** `nixos-runtime` still runs on pull requests, because the release closure attests it for the commit being tagged.
|
|
28
|
+
- **Measurement:** the next `TIMINGS` line is the result for this change; it is not claimed here. Releasing a commit already merged through its own pull request is `ship --release-only`, which waits only for the hosted release workflow.
|
|
29
|
+
|
|
12
30
|
## 0.195.1 - Hosted CI split so its slowest blocking job is about four minutes, not twelve
|
|
13
31
|
|
|
14
32
|
Why: the requirement is a release in under 10 minutes once the code is committed. Measured on the 0.195.0 pull request, the slowest blocking hosted job was `language-suites` at 12.1 min, then `language-tools-ghc` 10 min, the test shards 6 to 8 min, `bench-gates` 6.4 min and `proof-container` 5.3 min, and the release workflow after the tag is about 4.8 min (75 s waiting for a runner, 145 s for the `rest` gate leg, 66 s to publish). CI then the release workflow in series cannot fit 10 minutes unless the longest CI job is cut to about 4.
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@clear-capabilities/agentic-security-scanner",
|
|
3
|
-
"version": "0.195.
|
|
3
|
+
"version": "0.195.3",
|
|
4
4
|
"description": "Scanner engine for the agentic-security Claude Code plugin: SAST, SCA with reachability and CISA KEV, secrets, IaC, Haskell and Nix/NixOS, prompt-injection, MCP/agent-tool audit, authZ analysis, SBOM, compliance attestation, and more.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "src/index.js",
|